Throttle actuator safety method for automated transmission

ABSTRACT

A safety method is provided for use with control systems for vehicles such as trucks, and in particular for electromechanical controls (10) that assist the driver in shifting the gears (12), operating the clutch (16), and in actuating the throttle (22, 24, 26) by remote control. The method, which is for use in a vehicle&#39;s throttle-actuator subsystem (26A), utilizes a transmission control processor (42A) and a throttle control processor (42B). The method ascertains whether, when the driver of the vehicle removes his foot from the accelerator pedal (24A), control of the fuel pump (26C) returns to the idle governor as it should. The flow of fuel is stopped if it does not return properly. Also, a method is provided that monitors the throttle actuator (26A) to insure that it accurately follows throttle commands such as the position of the accelerator pedal (24A).

This is a divisional application under 37 CFR 1,60, of Ser. No.07/451,392, filed 12/15/89, now U.S. Pat. No. 5,048,481 entitled"Throttle Actuator Safety Method for automated Transmission", ofinventors Kwok Wah Chan, William F. Cote' and Louis E. Miller.

FIELD

This invention relates to control systems for vehicles such as trucks,and in particular for electromechanical controls that assist the driverin shifting the gears, operating the clutch, and actuating the throttleby remote control.

BACKGROUND OF THE INVENTION

Automatic transmissions of both the automatic mechanical type utilizingpositive clutches and the planetary gear type utilizing frictionalclutches are well known in the prior art, as are control systems forthem.

Electronic control systems utilizing discrete logic circuits and/orsoftware-controlled microprocessors for automatic transmissions in whichgear selection and shift decisions are based upon certain measuredand/or calculated parameters are also known. The parameters includevehicle speed (or transmission output shaft speed), transmission inputshaft speed, engine speed, rate of change of vehicle speed, rate ofchange of engine speed, throttle position, rate of change of throttleposition, full depression of the throttle (i.e. "kickdown"), actuationof the braking mechanism, currently engaged gear ratio, and the like.Examples of such automatic and semi-automatic transmission controlsystems for vehicles are in U.S. Pat. Nos. 4,361,060, 4,551,802,4,527,447, 4,493,228, 4,425,620, 4,463,427, 4,081,065, 4,073,203,4,253,348, 4,038,889, 4,226,295, 3,776,048, 4,208,929, 4,039,061,3,974,720, 3,478,851 and 3,942,393, all of which are incorporated byreference.

Automatic control systems for controlling the engagement anddisengagement of master clutches in vehicles having automated manualtransmissions (AMT) are known in the prior art, as may be seen in U.S.Pat. Nos. 4,792,901, 4,493,228, 4,081,065, 4,401,200, 4,413,714,4,432,445, 4,509,625 and 4,576,263, all of which are incorporated byreference. An example of a control system for adjusting fuel in view ofthrottle setting is in U.S. Pat. No. 4,493,228, which is incorporated byreference.

SUMMARY OF THE INVENTION

An object of the invention is to provide a safety method for a vehicle'sthrottle actuator subsystem that ascertains whether, when the driverremoves his foot from the accelerator pedal, control of the fuel pumpreturns to the idle governor as it should, and that stops the flow offuel if it does not.

Another object is to provide a method that monitors a throttle actuatorto insure that it accurately follows throttle commands such as theposition of the accelerator pedal.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a simplified block diagram of an Automated Manual Transmission(AMT) for a vehicle.

FIG. 2 is simplified block diagram of a preferred embodiment of thethrottle actuator safety subsystem.

FIG. 3A is a chart of a first group of method steps performed by thetransmission control processor.

FIG. 3B is a continuation of FIG. 3A, showing a second group of methodsteps performed by the transmission control processor.

FIG. 4 is a chart of steps performed by the throttle control processor.

FIG. 5 is a chart of steps for determining what action to take when twofeedback signals disagree.

FIG. 6 is a chart of steps for monitoring the correctness of signalsfrom feedback devices.

DESCRIPTION OF THE PREFERRED EMBODIMENT Automated Manual Transmission.FIG. 1

To provide an example of the invention, the manner in which it is usedin a specific AMT is described. The major components and connections ofthe AMT are shown in FIG. 1. It schematically illustrates an AMT system10 including an automatic multi-speed compound change gear transmission12 driven by a throttle-controlled engine 14, such as a diesel engine,through a master clutch 16.

An engine brake, such as an exhaust brake 17 for retarding therotational speed of engine 14 and/or an input shaft brake 18, which iseffective to apply a retarding force to the input shaft upondisengagement of master clutch 16, may be provided, as is known in theprior art. The output of automatic transmission 12 is an output shaft 20which is adapted for driving connection to an appropriate vehiclecomponent such as the differential of a drive axle, a transfer case orthe like.

These power train components are acted upon and monitored by severaldevices. They include a throttle position monitor assembly 22, whichsenses the position of the vehicle's throttle and provides signalsaccordingly; a fuel control device 26 for controlling the amount of fuelto be supplied to engine 14; an engine speed sensor 28, which senses therotational speed of the engine; a clutch operator and sensor 30, whichengages and disengages the clutch 16 and supplies information as to thestatus of the clutch; an input brake operator 31; a transmission inputshaft speed sensor 32; a transmission operator 34, which is effective toshift the transmission 12 into a selected gear ratio and to provide asignal indicative of current transmission status; and a transmissionoutput shaft speed sensor 36.

A vehicle brake monitor 38 senses actuation of the vehicle's brake pedal40. Alternatively, the engaged gear ratio of transmission 12 may becalculated by comparing the input shaft speed signal 32 with the outputshaft speed signal 36.

These devices supply information to and accept commands from a CentralProcessing Unit (CPU) 42, which controls the AMT. The CPU 42 may includeanalog and/or digital electronic calculation and logic circuitry, whosespecific configuration and structure are not part of the presentinvention. The CPU 42 also receives information from a shift controlassembly 44 by which the vehicle operator may select a reverse (R),neutral (N), or forward drive (D) mode of operation of the vehicle.

An electrical power source (not shown) and a source of pressurized fluid(not shown) provide electrical and pneumatic power to the varioussensing, operating and processing units. A fault indicator or alarmdevice 46 may display the identity of a specific fault or simply signalthe existence of an unidentified fault. Drive train components andcontrols therefor of the type described above are known in the prior artand are explained in greater detail in the above-mentioned U.S. Pat.Nos. 4,361,060; 3,776,048; 4,038,889 and 4,226,295.

Sensors 22, 28, 32, 36, 38 and 44 may be of any known type orconstruction for generating analog or digital signals indicative of theparameters monitored. Similarly, operators 17, 31, 26, 30 and 34 may beof any known electrical, pneumatic or electropneumatic type forexecuting operations in response to command signals from the CPU 42.

Fuel control device 26 normally supplies fuel to the engine 14 inaccordance with the operator's setting of throttle 24 but may, tosynchronize the transmission during an upshift or downshift or toProvide a smooth start, supply a greater or smaller amount of fuel inresponse to commands from the CPU 42.

The purpose of the CPU 42 is to select, in accordance with a Program(i.e. predetermined logic rules) and current or stored parameters, theoptimal gear ratio at which the transmission should be operating and, ifnecessary, to command a gear change (shift), into the selected optimalgear ratio based upon the current and stored information.

The various functions to be performed by the CPU 42 and a preferredmanner of performing them may be seen in more detail in U.S. Pat. No.4,595,986 and in Society of Automotive Engineers (SAE) Paper No. 831,776published in November 1983, which are incorporated by reference.

The clutch operator 30 is preferably controlled by the CPU 42 to engageand disengage the master clutch 16 as described in above-mentioned U.S.Pat. No. 4,081,065. The transmission 12 may include synchronizing means,such as an accelerator and/or a brake mechanism as described in U.S.Pat. No. 3,478,851, incorporated by reference. The transmission 12 isPreferably, but not necessarily, of the twin countershaft type asdescribed in U.S. Pat. No. 3,105,395, incorporated by reference.

Throttle Actuator Safety Subsystem. FIG. 2

This section describes components and interconnections involved in thethrottle actuator safety subsystem.

The Central Processor Unit (CPU) 42 in this embodiment utilizes twoprocessors, each performing different operations, to accomplish all ofthe information-processing functions of the AMT system. One of them is atransmission control processor 42A, which performs the system-levelprocessing; the other is a throttle control processor 42B, whichperforms some of the real-time input and output operations.

Each of the processors 42A, 42B, acting alone is capable of shutting offthe fuel flow to the engine 14 if necessary, by acting on a fuel pump26C. As shown on FIG. 2, there is a connection 23 called "fuel shut-offA" from the transmission control Processor 42A to the fuel pump 26C.There is also a connection 25 called "fuel shut-off B", from thethrottle control processor 42B to the fuel pump 26C.

The transmission control processor 42A receives from an acceleratorpedal sensor 22P a linear signal (terminal 22A) indicating the positionof the accelerator 24A. The accelerator pedal sensor 22P also sends anaccelerator idle switch signal (terminal 22B) to the transmissioncontrol Processor 42A indicating whether or not the accelerator 24A isin the idle position.

The throttle control processor 42B sends throttle commands on a line 50to a throttle actuator 26A. The throttle actuator 26A is part of thefuel control device 26 of FIG. 1. The throttle actuator 26A sends linearthrottle feedback information (terminal 22C) indicating the throttleactuator's position back to the throttle control processor 42B. Thethrottle actuator 26A also sends a (throttle) idle switch safety signal(terminal 22D) back to the throttle control processor 42B, indicatingwhether or not the throttle actuator is in the idle position.

A driver console 45 sends commands (terminal 46A) to the transmissioncontrol processor 42A and (terminal 46B) to the throttle controlProcessor 42B. The driver console 45, which includes the fault indicator46 of FIG. 1, receives display information (terminal 44A) from thetransmission control processor 42A and (terminal 44B) from the throttlecontrol processor 42B.

The throttle control processor 42B also receives engine speedinformation on a line 52 from the engine speed sensor 28.

Neither the transmission control Processor 42A nor the throttle controlprocessor 42B, when isolated from the other, has complete information onthe state of the fuel system. Therefore, it is necessary for normal fuelcontrol that the two processors communicate with each other. Aninterprocessor communication subsystem, symbolized by line 42C, isprovided for this purpose.

Within the interprocessor communication subsystem 42C each Processor42A, 42B, has several ways to determine whether communications betweenprocessors have broken down. Breakdown of communications may be partialor complete. In the event that communications do break down, eachprocessor independently attempts to insure that the throttle actuator26A is held in a safe state. The method for doing that is one of thesubjects of this invention.

During normal operation the transmission control processor 42A informsthe throttle control processor 42B via the communications lines 42C howmuch fuel the transmission control processor 42A is requesting; this isa throttle command. (The throttle control processor 42B then forwards athrottle command on line 50 to the throttle actuator 26A.) The throttlecontrol processor 42B sends information to the transmission controlprocessor 42A (throttle feedback), as to the monitored actual positionof the throttle actuator 26A. Both of these values are scaled betweeen 0and 100%.

Transmission Control Processor. FIGS. 3A and 3B

This section describes method steps Performed by the transmissioncontrol processor 42A in Performing those of its functions that relateto the throttle actuator safety subsystem. The accompanying diagram isarbitrarily divided into FIGS. 3A and 3B for convenience of drawing it.

Upon a failure of communications between the two processors 42A, 42B,the transmission control processor 42A still has accurate driver commandinformation (22A, 46A) but only partial information on the state of thethrottle actuator 26A. See block 56 of FIG. 3A. The processors 42A, 42Bmonitor themselves in respect of routine communications capability, inany of many ways that are well-known in computer art. For example, theycan detect absence of periodic monitoring signals of PredeterminedProper format when the signals do not occur at the expected times or inexpected format. The transmission control processor 42A does not takeany safety action when communication with the throttle control processor42B is impaired as long as the driver's foot continues to depress theaccelerator pedal 24A (block 58), as indicated by the accelerator idleswitch 22B.

When the driver commands the fuel flow to an idle (22B) by releasing thepedal (line 60), a 300-millisecond delay is provided (block 62). Thenthe idle safety switch signal (22D) is automatically examined (block64). If the idle safety switch signal does not indicate an idlecondition after 300 milliseconds, the fuel pump 26C is turned off (block66). On the other hand, if the idle safety switch signal 22D doesindicate an idle condition after the 300-millisecond delay (68), noremedial action is taken by the transmission control Processor 42A.

Even when the interprocessor communication subsystem 42C is functioningproperly, the transmission control Processor 42A Performs some of theProcessing required to insure safe operation of the throttle actuator26A. An important safety aspect relating to the operation of thethrottle actuator 26A is to insure that when the driver removes his footfrom the Pedal 24 the throttle actuator 26A in fact returns to idle. Thetransmission control processor 42A, not the throttle control processor42B, monitors this aspect, as will now be described.

As shown in the left column of FIG. 3A, when the processors 42A, 42B arecommunicating properly, the transmission control Processor 42Acalculates a throttle command (block 70) on the basis of the pedal input22A. The throttle command is transmitted (72) to the throttle controlprocessor 42B, and the throttle feedback signal (22C), is passed back(74) from the throttle control processor 42B to the transmission controlprocessor 42A. The throttle command and the throttle feedback arecompared in block 76.

When the driver commands (24) a zero-Percent throttle setting (idle), a300-millisecond delay is initiated (78) to give the throttle actuator26A enough time to return to the idle position. At the end of thatdelay:

(a) If both idle switch feedback signals (accelerator idle switch 22Band idle safety switch 22D) indicate an idle condition, it is inferredthat the throttle actuator 26C is obeying its commands (block 80 of FIG.3B); all is well (81) and no corrective action is taken.

(b) If neither of the switches 22B or 22D indicates idle (block 82), afault is declared and the fuel to the engine is shut off (block 84).

(c) If one of the mechanisms indicates idle and the other does not, thesystem automatically makes further tests before acting (block 86), asdescribed in a section below headed "When Feedback Signals AreContradictory".

When the driver commands (24) a non-zero percent throttle setting (77),a procedure (79) is employed called "Verifying Compliance With ThrottleCommands", which is described below and in FIG. 6.

Throttle Control Processor, FIG. 4

Some of the critical real-time input/output operations that areperformed by the throttle control processor 42B during normal fault-freeoperation are: (a) collection of wheel-speed sensor data 28; (b)closed-loop control of the throttle actuator 26A; and (c) interfacing(44B, 46B) with the driver's command console 45. See FIG. 2.

As shown in FIG. 4, upon loss of communication 42C between processors,the throttle control processor 42B uses a different approach (block 90)than does the transmission control Processor 42A. The throttle controlprocessor 42B no longer has any information regarding the level offueling being requested (22A) by the driver. Therefore, for safety, itattempts to drive the throttle actuator 26A back to idle position (block92), and it turns on a "stop vehicle" indicator lamp on the driver'scommand console 45.

Thereafter, if the throttle control processor 42B receives verification(block 94) that the throttle actuator 26A has returned to idle position(both the linear feedback signal 22C and the idle safety switch's signal22D indicate that the throttle actuator is at idle) then no furthersafety action is taken (95). If verification of a return to idle is notreceived, the flow of fuel to the fuel pump is shut off (96).

FIG. 4 also shows how the throttle control processor 42B passes throttlesignals back and forth between the throttle actuator 26A and thetransmission control processor 42A. The throttle control processor 42Breads (block 98) throttle commands that it receives via communicationsystem 42C from the transmission control processor 42A. These commandsare forwarded (block 100) to the throttle actuator 26C. Throttlefeedback signals 22C from the throttle actuator 26C are received (block104) by the throttle control processor 42B and forwarded (106) to thetransmission control processor 42A.

When Feedback Signals Are Contradictory, FIG. 5

The two feedback devices that ordinarily provide information as towhether the throttle actuator 26A is at idle are a position feedback pot(signal 22C) and the idle safety switch (signal 22D). In an event inwhich one of those signals indicates that the throttle actuator 26A isat idle and other indicates that it is not, the safety subsystemattempts to determine which of the devices is providing correctinformation, and acts accordingly.

If the driveline is locked up (block 110), i.e., the clutch 16 isengaged and the transmission 12 is in gear, there is no easy way toascertain which of the throttle actuator's differing feedback devices iscorrect. Therefore, the safest response is to stop the fuel to theengine (block 112). On the other hand, if the driveline is not lockedup, an opportunity is available to ascertain something about theposition of the throttle actuator by examining the engine speed (block114).

If the engine speed 28 exceeds a first predetermined threshold value farabove idle speed, such as 1900 rpm, it is apparent that the throttleactuator 26A is not at idle position. A fault is then declared and thefuel is shut off (block 116).

If the engine speed is below a second predetermined threshold valueslightly above nominal idle (block 118), it is relatively safe to assumethat the throttle actuator 26A has returned to the idle position. Thefuel is left on, because there was only a false alarm. A fault isdeclared (block 120), identifying which of the feedback devices isproviding false information.

The remaining case occurs when the engine speed is between the twothreshold values just described. In that instance a further delay of 500milliseconds is initiated (block 122) to insure that the engine has hadsufficient time to respond. If, at the end of the 500-millisecond delay,the engine speed is still not within the idle range, the fuel is shutoff (block 124).

Verifying Compliance With Throttle Commands. FIG. 6

It is desirable for the throttle actuator 26A accurately to track thecommands (22A, 50) of the driver at settings other than idle; both ofthe throttle actuator's feedback device signals 22C, 22D arePeriodically monitored to detect certain types of malfunctions

When the throttle command 50 exceeds a predetermined relatively lowthreshold such as 25% of full demand, (see block 130), a series of testsare automatically Performed under control of the throttle controlprocessor 42B. The tests are to ascertain whether the idle safety switch26D is functioning properly and the throttle actuator 26A is faithfullytracking the command 50.

The two feedback signals 26C and 26D from the throttle actuator 26A areexamined by the throttle control Processor 42B (block 132). If neitherthe idle safety switch 26D is indicating idle (by being closed), nor thefeedback pot signal 26C is indicating idle, no corrective action istaken (134). If either signal does indicate idle (136), a300-millisecond delay is interposed to give those feedback devicesenough time to settle into correct Positions (block 138). If, at the endof the delay, either of the two feedback devices is still indicatingidle, it is assumed that a malfunction has occurred, and a fault isdeclared (block 140).

In order to test whether the throttle actuator is correctly tracking thedemand, the throttle feedback signal is compared with the throttlecommand when the accelerator pedal is not moving. If the throttlefeedback signal exceeds the command by more than 10%, a 300-milliseconddelay is initiated to give the throttle feedback signal time to comewithin that 10% range. If the throttle actuator does not come within 10%of command during that delay time a fault is declared. A simple figureillustrating the steps of this feature could be similar to the figuresdescribed above.

Scope of Invention

Although a fully automatic AMT system 10 is illustrated, the presentinvention is also applicable to semi-automatic AMT systems where thesystem automatically executes driver-selected gear changes.

Although the AMT system 10 has been described as utilizing amicroprocessor-based control 42 and the methods and operations arecarried out as software algorithms, it is clear that the operations canalso be carried out in electronic or fluidic logic circuits comprisingdiscrete hardware components.

Although the present invention has been set forth in terms of aparticular preferred embodiment, various modifications including but notlimited to those alluded to above are possible within the scope of theinvention as claimed.

We claim:
 1. For use in a vehicle having an accelerator (24A), athrottle, a fuel flow system, and an electronic control system (10); amethod for insuring safety, comprising the steps of:providing a throttlecommand (22A, 42A, 70) for controlling the throttle; ascertaining (76)whether the throttle command substantially equals idle; sensing (80)whether the accelerator (24A) is at idle position and providing anaccelerator idle signal (22B) accordingly; sensing (80) whether thethrottle is at idle position and providing an idle safety signal (22D)accordingly; stopping the flow of the fuel system (26C, 84) if (a) thethrottle command substantially equals idle and (b) the accelerator idlesignal (22B) indicates nonidle, and (c) the idle safety signal (22C)indicates non-idle; but not stopping the flow of the fuel system ifeither: (d) said throttle command does not substantially equal idle; or(e) either one but not both of said accelerator idle signal and saididle safety signal is indicating idle.
 2. For use in a vehicle having anaccelerator 24A, a throttle, a fuel flow system, and an electroniccontrol system (10), a method for insuring safety of the control system,comprising the steps of:providing a throttle command (22A, 42A, 70) forcontrolling the throttle; ascertaining (76) whether the throttle commandsubstantially equals idle; sensing (80) whether the accelerator (24A) isat idle position and providing an accelerator idle signal (22B)accordingly; if (a) the throttle command substantially equals idle,providing a time delay (78); stopping the flow of the fuel system (26C,84) if, after said time delay, (b) the accelerator idle signal (22B)indicates non-idle, and (c) the idle safety signal (22C) indicatesnon-idle; but not stopping the flow of the fuel system if any one ormore of the following conditions is met: (d) said throttle command hasnot substantially equalled idle for longer than said predetermined timedelay (78); or (e) both the accelerator idle signal and the idle safetysignal indicate idle; or (f) both the accelerator idle signal and theidle safety signal indicate non-idle.
 3. For use in a vehicle having anaccelerator 24A, a throttle, a fuel flow system, and an electroniccontrol system (10) including at least two control processors (42A,42B), a method for insuring safety, comprising the steps of:sensing (56)whether said control processors are communicating and if not: sensing(58) whether the driver's foot is depressing the accelerator pedal(24A), and providing an accelerator idle signal (22B, 60) accordingly;providing a time delay (62) starting when said accelerator idle signal(22B) indicates that the accelerator pedal (24A) is not longer beingdepressed; sensing (64) whether the throttle is at idle position andproviding an idle safety signal (22D) accordingly; stopping the flow ofthe fuel system (26C, 66) if, after said time delay, the idle safetysignal (22D) indiates that the throttle is not at idle position; but notstopping the flow of the fuel system if either: (a) the accelerator idlesignal indicates non-idle (58); or (b) said time delay (62) has not yetelapsed; or (c) after said time delay (62) has elapsed said idle safetysignal indicates idle (68).